Calero vulnerabilities
We track 3 vulnerabilities in Calero products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 13, 2026.
Latest Calero vulnerabilities
- 9.8 Critical severity
VeraSMART: Use of Hard-coded Cryptographic Key
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a val
- 7.8 High severity
VeraSMART: Use of Hard-coded Credentials
Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. A
- 9.8 Critical severity
VeraSMART: Missing Authentication for Critical Functionality
Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatte